Skip to content
CVSS 7.4 · HIGH

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Ver en NVD

Severidad

Puntaje: 7.4(HIGH)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV: NETWORK
AC: HIGH
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: NONE
Tipo de falla (CWE): CWE-326

EPSS

Probabilidad de explotación (próx. 30 días): 0.8969 (89.7%)
Percentil: 99.6%
EPSS: 2026-05-06

Afecta

openssl:opensslredhat:jboss_enterprise_application_platformredhat:jboss_enterprise_web_platformredhat:jboss_enterprise_web_serverredhat:storagefedoraproject:fedoraopensuse:opensuseredhat:enterprise_linuxfilezilla-project:filezilla_serversiemens:application_processing_engine_firmwaresiemens:application_processing_enginesiemens:cp1543-1_firmwaresiemens:cp1543-1siemens:s7-1500_firmwaresiemens:s7-1500siemens:rox_firmwaresiemens:roxmariadb:mariadbpython:pythonnodejs:node.js

Descripción técnica

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Publicada: 5/6/2014, 21:55:07
Última modificación: 6/5/2026, 22:30:45

Referencias

InicioEventosBlogRecursosEquipo